1. Field of the Invention
The present invention relates to wireless networking, and more particularly, to an authentication and secure communication technique for Wi-Fi (IEEE 802.11) networks.
2. Description of Related Art
A Wireless Local Area Network (WLAN) is generally implemented to provide local connectivity between a wired network and a mobile computing device. In a typical wireless network, all of the computing devices within the network broadcast their information to one another using radio frequency (RF) communications. WLANs are based on the Institute of Electrical and Electronic Engineers (IEEE) 802.11 standard, which designates a wireless-Ethernet specification using a variety of modulation techniques at frequencies generally in the 2.4 gigahertz (GHz) and 5 GHz license-free frequency bands.
The IEEE 802.11 standard (“Wi-Fi”) enables wireless communications with throughput rates up to 54 Mbps. Wi-Fi (for “wireless fidelity”) is essentially a seal of approval certifying that a manufacturer's product is compliant with IEEE 802.11. For example, equipment carrying the “Wi-Fi” logo is certified to be interoperable with other Wi-Fi certified equipment. There are Wi-Fi compatible PC cards that operate in peer-to-peer mode, but Wi-Fi usually incorporates at least one access point, or edge device. Most access points have an integrated Ethernet controller to connect to an existing wired-Ethernet network. A Wi-Fi wireless transceiver connects users via the access point to the rest of the LAN. The majority of Wi-Fi wireless transceivers available are in Personal Computer Memory Card International Association (PCMCIA) card form, particularly for laptop, palmtop, and other portable computers, however Wi-Fi transceivers can be implemented through an Industry Standard Architecture (ISA) slot or Peripheral Component Interconnect (PCI) slot in a desktop computer, a Universal Serial Bus (USB), or can be fully integrated within a handheld device.
When network packets are formed, they typically result from a process known as encapsulation. FIG. 4 shows the “layered” sequence of packet formation well known as the “protocol suite.” See Richard Stevens, TCP/IP Illustrated, Vol. 1 (Addison-Wesley ISBN 0-201-63346-9). All network packets are typically identified by an Ethernet Header (150). The addition of 802.11 wireless functionality adds yet another layer below the link layer and is known as the 802.11 layer and this layer adds an additional 802.11 header (410). The Client Network Interface Card (NIC) (110) adds the 802.11 header (410) to the Ethernet packet and is used to transport the Ethernet packet across the wireless medium
On receipt of an 802.11 packet from an authenticated and associated Client NIC (110), the Access Point (140) will remove the 802.11 header (410) and place the remaining packet on the Ethernet cable (150). The Ethernet packet stripped of its 802.11 header is placed on the LAN as if the Client PC were directly connected on the LAN instead of being bridged by the combination of Client NIC (110) and Access Point (140). This process of stripping headers is known as “de-multiplexing”. As seen in FIG. 1, the 802.11 network (WLAN, 130) comprises at least one Access Point (140) attached via Ethernet cable (150) to the wired network (LAN, 190). The Access Point (140) provides a wireless bridge for connecting clients PCs (120) to the LAN, 190. The process of connection when security is not invoked is for the client NIC (110) to perform an Open Authentication to the Access Point (140). As the authentication is “open”, any Client will be automatically authenticated. The Access Point (140) grants permission to the Client NIC (110) to “associate” to the Access Point (140). The Client NIC (110) then “associates” to the Access Point (140) and the Client's PC (120) is now “bridged” to the LAN (190).
The process of bridging involves the Access Point (140) to manage the wireless traffic and remove the 802.11 header (410) placing the packet on the Ethernet cable as if the Client PC (110) were “hard-wired” to the network. In the case of Wired Equivalent Privacy (WEP) security, the process is identical except that the 802.11 authentication type is changed from “open” to “WEP’ and the predefined WEP parameters are used by the NIC (110) to encrypt communications from the Client PC (120) to the Access Point (140). The Access Point (140) decrypts all packets coming from the Client PC (120) using the pre-defined WEP parameters. Turning on WEP encryption prevents and Client NIC (110) not using the exact WEP parameters from connecting to the Access Point (140) and gaining access to the network (190). The WEP parameters thus are employed both for authentication and encryption purposes.
The Access Point (140) maintains the relationship between itself and the Client NIC (110) by means of the Client's MAC address (105). The Client's MAC address is the mechanism by which a Client's connection is managed by the Access Point (140). The Access Point (140) typically employs WEP security, a software algorithm that is used both for authentication purposes and to provide wireless link security. If WEP is turned on in the Access Point (140), no other users can connect to the Access Point without WEP turned on in their Client NIC (110) and the proper WEP parameters matching those in the Access Point turned on as well. This issue makes it impossible to support both people who desire security and those who do not at the same time.
The Institute of Electrical and Electronic Engineers (IEEE) has announced improvements to the security processes utilized in the 802.11 specifications. These improvements are known as Wireless Protected Access (WPA) and WPA2. Both improvements provider a greater degree of security over WEP, but still do not permit both secure and non-secure Clients to connect to the same Access Point. WPA2, in particular, requires new Access Point hardware and new Client NIC cards to be purchased by users who desire to use the improved WPA2 security. While a WPA2 Access Point will support WEP clients, it cannot support both WPA2 and WEP-based clients at the same time.
There are three typical types of authentication that are available for use with 802.11b networks: Open system; Shared Key; and IEEE 802.1X.
Open system authentication authenticates all wireless nodes using the Client NIC MAC Address (105), its wireless adapter hardware address. A hardware address is an address assigned to the network adapter during its manufacture and is used to identify the source and destination address of wireless frames.
For infrastructure mode, although some wireless APs allow you to configure a list of allowed hardware addresses for open system authentication, it is a fairly simple matter for a malicious user to capture frames sent on your wireless network to determine the hardware address of allowed wireless nodes and then use that hardware address to perform open system authentication and join your wireless network.
For ad hoc mode, there is no equivalent to configuring the list of allowed hardware addresses in Windows XP. Therefore, any hardware address can be used to perform open system authentication and join your ad hoc mode-based wireless network.
Shared key authentication verifies that the wireless client joining the wireless network has knowledge of a secret key. During the authentication process, the wireless client proves it has knowledge of the secret key without actually sending the secret key. For infrastructure mode, all the wireless clients and the wireless AP use the same shared key. For ad hoc mode, all the wireless clients of the ad hoc wireless network use the same shared key.
The IEEE 802.1X standard enforces authentication of a network node before it can begin to exchange data with the network. Exchanging frames with the network is denied if the authentication process fails. Although this standard was designed for wired Ethernet networks, it has been adapted for use by 802.11b. IEEE 802.1X uses the Extensible Authentication Protocol (EAP) and specific authentication methods known as EAP types to authenticate the network node.
IEEE 802.1X provides much stronger authentication than open system or shared key and the recommended solution for Windows XP wireless authentication is the use of EAP-Transport Level Security (TLS) and digital certificates for authentication. To use EAP-TLS authentication for wireless connections, you must create an authentication infrastructure comprising of an Active Directory domain, Remote Authentication Dial-In User Service (RADIUS) servers, and certification authorities (CAs) to issue certificates to your RADIUS servers and wireless clients. This authentication infrastructure is appropriate for large businesses and enterprise organizations, but is not practical for the home or small business office.
A solution to the use of IEEE 802.1X and EAP-TLS for the medium and small business is being developed. Windows XP Service Pack 1 and the Windows .NET Server 2003 family will both support Protected EAP (PEAP) and the Microsoft Challenge-Handshake Authentication Protocol, version 2 (MS-CHAP v2) EAP type. With PEAP and MS-CHAP v2, secure wireless access can be achieved by installing a purchased certificate on a RADIUS server and using name and password credentials for authentication.
Hot Spots typically provide no wireless link security. This is due to the fact that there is no mechanism for managing “keys” for transient users. The existing technology is vulnerable to hackers and the newer technology will not allow AES encryption to be run in the same Access Point as WEP-enabled customers. Hot Spots are faced with a situation wherein they cannot deploy the newer security technology as it means they will lose existing customers unless their customers also upgrade to the newer technology.
“Koolspan” functionality provides for mutual authentication of both the Client and the Network Edge device, typically an Access Point based on secure, tamper-resistant tokens on both sides of the wireless link. The modifier “Koolspan” refers to the authentication and secure communication technique(s) disclosed in U.S. patent application Ser. Nos. 10/679,371; 10/679,268; and 10/679,472, the disclosures of which are incorporated by reference in their entirety. As a product of this authentication process, a “Session Key” is independently generated on both sides of the link that is used to secure communications across the link for the duration of the session. Typically, the Access Point software is modified to provide for Koolspan authentication and to read an attached Koolspan token. Since this functionality requires modification of the Access Point software and an available port into which the token can be attached, not every Access Point can directly support Koolspan functionality. Existing wireless networks implement WEP security, the original security standard for 802.11 networks. This security mechanism is not safe and can be easily cracked. Newer technologies such as WPA and WPA2 are more secure, but will require new Access Points to be deployed and or new Network Interface Cards (NIC) for the user to install. It is highly desirable, therefore, that a means be provided that would allow the network to achieve Koolspan functionality without requiring the Access Points to be modified or replaced.